How do you stop an office full of computers from shouting over each other and accidentally sending private data to the wrong person? This chapter solves the problem of splitting a single physical network into multiple, secure, virtual networks without buying new cables. For the NSE4 exam, you must understand how Fortinet firewalls create these virtual networks (VLANs) and control traffic between them using VLAN interfaces.
Jump to a section
A simple way to picture VLAN Interfaces and Basic Switching
Because a company has different departments (Sales, HR, Engineering) that use the same building, the network would be chaotic and insecure if everyone shared one big open room. So you split the building into separate apartments, each with a key.
Think of a physical office building that houses three separate companies: a bakery, a law firm, and a tech start-up. All three companies share the same entrance hall, the same mailroom, and the same electrical wiring. The bakery's deliveries go to the same loading dock as the law firm's confidential documents. This is a massive security risk and privacy nightmare. To fix this, the building manager paints each floor a different colour and issues special keys. Everyone inside the building can still use the main entrance (the physical switch), but the colour of the floor and the key you hold determine exactly which rooms, hallways, and meeting spaces you can access. The bakery staff have a red key (VLAN 10) that only opens doors on the first floor. The law firm has a blue key (VLAN 20) for the second floor. The tech start-up has a green key (VLAN 30) for the third floor. When the mail (data) arrives at the main entrance, the doorman (the switch) checks the key colour on the envelope (the VLAN tag) and sends it directly to the correct floor without letting other floors see it. This keeps the bakery's flour orders separate from the law firm's case files, even though they share the same building, power, and front door. The 'VLAN interface' is like the electronic key reader on each floor's door that only allows access if your key colour matches.
Imagine a single water pipe in a building. Everyone's water runs through the same pipe. If one person flushes a toilet, the pressure drops for the person taking a shower. This is how a basic network switch works without VLANs: all devices (computers, printers, servers) connected to the switch are on the same 'broadcast domain'. A broadcast is a shout-out to every device on the network. When a computer sends a broadcast, every single device must stop what it is doing, listen, and decide if the message is for it. This wastes time and creates a security risk because a malicious shout-out can be heard by everyone.
A VLAN (Virtual Local Area Network) is a technology that solves this by carving the single physical switch into multiple, isolated virtual switches. Think of it like painting different apartments on the same floor different colours. Even though they share the same physical floor (the switch), a person in the blue apartment cannot talk to a person in the red apartment without going through a special door (a router or a Layer 3 device). The switch uses a tag (a small label attached to the data) to know which 'colour' each piece of data belongs to. This tag is called a VLAN ID (e.g., VLAN 10, VLAN 20).
To make VLANs work across multiple switches (which is the real world), you need a trunk port. A trunk port is a special connection between two switches that carries traffic for many VLANs simultaneously. Imagine the hallway that connects the red apartment building to the blue apartment building: the mail carrier (the data) wears a coloured armband (the VLAN tag) the whole time, so the next building's doorman knows exactly which apartment to deliver it to. Without a trunk, the mail would lose its colour tag and get delivered to the wrong place.
Now, the 'VLAN interface' is the crucial concept for the NSE4 exam. A VLAN interface (often called a 'virtual interface' or 'VLAN SVI' - Switch Virtual Interface) is a software-based gateway that the FortiGate firewall creates to route traffic between different VLANs. A standard switch works at Layer 2, which only uses MAC addresses (like a person's unique name). It cannot route data between different coloured apartments. The FortiGate firewall, however, works at Layer 3 and can route traffic. By creating a VLAN interface (e.g., 'VLAN 10' with IP address 192.168.10.1), the FortiGate becomes the doorman for that specific apartment block. Every device in VLAN 10 will send its traffic 'up' to the firewall's VLAN interface when it needs to talk to a device in VLAN 20.
Basic switching features like Spanning Tree Protocol (STP) exist to prevent a network disaster called a 'broadcast storm'. If you connect three switches in a loop (Switch A to B, B to C, and C back to A), a broadcast message will circle forever, multiplying until the network crashes. STP is an intelligent system that automatically detects these loops and 'blocks' one of the links. It is like having a bridge with three lanes but automatically closing the middle lane to prevent a traffic jam of cars going in circles. The FortiGate can interact with STP, meaning it can listen to the network's 'bridge discussions' and decide which ports to use and which to block.
Finally, DHCP Relay is a service that solves a practical problem. A DHCP server is a centralised computer that hands out IP addresses (like a passport office issuing unique passport numbers). If you have five different VLANs (apartments), you usually want one DHCP server in the main office to issue addresses to everyone. However, DHCP requests are broadcasts, and broadcasts usually cannot cross VLAN boundaries. DHCP Relay is a feature on the FortiGate or a Layer 3 switch that takes the broadcast request from a device in VLAN 10, wraps it up like a normal letter, and sends it directly to the DHCP server. The server sends the address back, and the relay forwards it to the device. It is like a secretary in a company who takes a message from a department that cannot phone the CEO directly and calls the CEO on their behalf.
Define the VLANs
First, plan which groups of users will be isolated from each other. For example, Sales (VLAN 10) and Engineering (VLAN 20). This step happens in your mind and on paper, not on the device. It defines the network segmentation strategy.
Configure the Physical Port on the FortiGate
Select the physical port that connects to the office switch (e.g., Port1). On this port, you must enable 'Administrative Access' if you want to manage the firewall through it. Then, configure the port as a 'trunk' by enabling '802.1Q' tagging. This tells the port to expect tagged traffic from the switch.
Create the VLAN Interface on the FortiGate
Navigate to Network -> Interfaces. Click 'Create New' and select 'VLAN'. Choose the parent interface (Port1), assign the VLAN ID (e.g., 10 for Sales), and give the new VLAN interface an IP address (e.g., 192.168.10.1/24). This IP becomes the default gateway for all devices in VLAN 10.
Configure DHCP Relay (or DHCP Server) on the VLAN Interface
Go to Network -> DHCP Server. Select the VLAN interface you just created. Choose 'Relay' mode. Enter the IP address of your central DHCP server (e.g., 10.0.0.5). This step ensures that devices in the new VLAN can automatically receive an IP address from the company's main server.
Configure Firewall Policies for Inter-VLAN Routing
Create Firewall Policies (Policy & Objects -> IPv4 Policy). Create a policy from the VLAN interface (e.g., VLAN 10) to the external interface (WAN) for internet access. Create another policy from VLAN 10 to VLAN 20 if Engineering needs to access Sales servers. Without these policies, VLANs remain isolated at Layer 3.
An IT professional at a medium-sized company, GlobalTrade Ltd., is asked to design a new office network. The company has 200 employees split into four departments: Sales, Engineering, HR, and Finance. Without VLANs, all 200 computers would be on one flat network. A virus on a Sales computer would instantly have access to the Finance server because they are on the same network. The IT administrator would also struggle with congestion because all 200 devices would be shouting broadcast messages at each other.
The administrator decides to use VLANs. She creates four VLANs on the main office switch (a managed switch) and configures them on the FortiGate firewall:
VLAN 10 for Sales, with the IP subnet 192.168.10.0/24
VLAN 20 for Engineering, with the IP subnet 192.168.20.0/24
VLAN 30 for HR, with the IP subnet 192.168.30.0/24
VLAN 40 for Finance, with the IP subnet 192.168.40.0/24
She then configures a VLAN interface on the FortiGate for each of these VLANs, giving each a unique IP address (e.g., 192.168.10.1 for VLAN 10). This IP address becomes the 'default gateway' for all devices in that VLAN. Every computer in Sales will be configured to send all traffic destined for outside its own VLAN to 192.168.10.1.
Now, the administrator needs to handle internet access and inter-VLAN routing. She creates firewall policies on the FortiGate. For example, she creates a policy that allows traffic from VLAN 10 (Sales) to access the internet but blocks access to VLAN 40 (Finance). This is a core security requirement. She also enables DHCP Relay on the FortiGate's VLAN interfaces. The company has a central DHCP server at IP 10.0.0.5. When a new Sales employee plugs in a laptop, the laptop sends a broadcast DHCP request. Since it is in VLAN 10, the request cannot reach the server. The FortiGate's VLAN 10 interface catches this request, sees that DHCP Relay is enabled, and forwards it to 10.0.0.5. The server allocates an IP address (e.g., 192.168.10.50), and the relay sends it back to the laptop.
Finally, the administrator must deal with the physical connections between the office switch and the FortiGate. She configures a single physical port on the FortiGate as a 'trunk' (often called an 802.1Q trunk). This single cable carries traffic for all four VLANs simultaneously. The administrator tags the traffic leaving the switch with the correct VLAN ID, and the FortiGate's trunk port reads the tag and delivers the data to the correct VLAN interface inside the firewall. This saves physical ports and simplifies cabling. She also configures RSTP (Rapid Spanning Tree Protocol) on the network switches and ensures the FortiGate is configured to respect STP BPDU (Bridge Protocol Data Unit) packets, preventing accidental loops that could crash the entire office network.
The NSE4 exam tests VLAN interfaces and basic switching heavily, but it does so in a specific, trap-laden way. You will not be asked to configure a 50-port switch. Instead, you will be given a scenario about a FortiGate firewall connected to a managed switch and asked to identify the correct configuration steps or the result of a misconfiguration.
The exam objectives (2.2) explicitly ask you to 'Create VLAN interfaces and configure basic switching features such as DHCP relay and spanning tree protocol interaction.' The key phrase is 'on the FortiGate'. NSE4 is about Fortinet gear. You must know exactly how the FortiGate handles VLANs, not just the general theory.
Specifically, the exam loves the following:
The relationship between a physical interface and a VLAN interface. You must know that a VLAN interface is a child of a physical interface. For example, if you configure VLAN 10 on physical port 'port1', the FortiGate creates a logical interface called 'port1.10' (or 'VLAN10' depending on the firmware version). You cannot create a VLAN interface without a parent physical interface.
The 'allowaccess' setting. This is a huge exam trap. The VLAN interface itself does not have IP management settings by default. To manage the firewall via a VLAN interface (e.g., using HTTPS to log into the web GUI from a computer in VLAN 10), you must specifically enable 'HTTPS' and 'PING' under the 'Administrative Access' options for that VLAN interface.
DHCP Relay configuration. The exam expects you to know that DHCP Relay is configured under the 'DHCP Server' settings on the FortiGate, but you select 'Relay' as the mode. You must specify the IP address of the external DHCP server. The trap is that beginners think the FortiGate must be the DHCP server. The exam tests whether you know it can be a relay.
STP interaction. The FortiGate is not a full STP switch. It can 'participate' by sending and receiving BPDU packets. The exam tests your understanding of 'port protection' features like 'root guard' and 'BPDU guard'. Specifically, if a port is configured with BPDU guard and it receives a BPDU packet, the port will be administratively disabled (shut down). The exam question might present a scenario where a loop occurs, and they ask 'why did the port go down?'.
The difference between 'tagged' and 'untagged' VLANs on the switch side (which connects to the FortiGate). The FortiGate's VLAN interface expects tagged traffic. The exam will present a scenario where traffic is not working between a PC and the FortiGate. The answer is often that the switch port connected to the FortiGate must be configured as a trunk port with the specific VLAN tagged.
Common exam traps include:
Asking you to create a VLAN interface without first assigning it to a physical interface.
Asking about 'inter-VLAN routing' and expecting the answer that the FortiGate (acting as the Layer 3 device) does this via the VLAN interfaces, not the physical port.
Providing a scenario where the DHCP Relay is not working because the 'server-ip' field is empty.
Confusing a 'VLAN interface' with a 'software switch' interface. A software switch is for bridging, while a VLAN interface is for routing between VLANs.
A VLAN (Virtual Local Area Network) splits a single physical switch into multiple, isolated broadcast domains, preventing traffic from one group from reaching another without a router.
A VLAN interface on a FortiGate is a logical Layer 3 interface that acts as the default gateway for all devices inside that specific VLAN.
A trunk port (802.1Q) is the connection that carries traffic for multiple VLANs simultaneously, using tags to identify each data packet's VLAN membership.
DHCP Relay is a service on a FortiGate that forwards DHCP broadcast requests from a VLAN to a central DHCP server located in a different subnet.
Spanning Tree Protocol (STP) automatically prevents network loops by blocking redundant paths; a loop can cause a broadcast storm that crashes the network.
The NSE4 exam frequently tests the 'allowaccess' setting on a VLAN interface, requiring you to enable HTTPS or PING to manage the firewall from that VLAN.
A VLAN interface must be created on a parent physical interface; you cannot create a VLAN interface without first selecting which physical port it belongs to.
These come up on the exam all the time. Here's how to tell them apart.
VLAN Interface (FortiGate)
Logical interface created on top of a physical port
Has an IP address that defines a subnet
Used for routing traffic between different VLANs
Physical Interface (FortiGate)
A physical port on the FortiGate device
Typically does not have a LAN IP address; carries tagged traffic
Used for connecting to a switch or other physical device
Trunk Port
Carries traffic for multiple VLANs simultaneously
Uses 802.1Q tagging to identify each VLAN
Typically connects switches to firewalls or between switches
Access Port
Carries traffic for only one VLAN (untagged)
Does not add VLAN tags to the traffic
Typically connects end devices like PCs or printers to a switch
DHCP Relay
Forwards DHCP requests to a central server
Does not manage or store IP address leases
Works across VLAN boundaries
DHCP Server
Manages and leases IP addresses to devices
Stores a database of assigned addresses
Sits on the same subnet as the devices or requires a relay to receive requests
Spanning Tree Protocol (STP)
Operates at Layer 2 (switch level)
Prevents loops in a network by blocking redundant links
Uses Bridge Protocol Data Units (BPDUs) to communicate
Routing Protocol (e.g., OSPF)
Operates at Layer 3 (router level)
Finds the best path between different networks
Uses routing updates (e.g., LSAs) to share topology
Mistake
VLANs are a security feature that completely isolates traffic, so no data can ever leave my VLAN without my permission.
Correct
VLANs isolate traffic at Layer 2 (the switch level). Traffic can still leave your VLAN if a Layer 3 device (like a FortiGate firewall) is configured with VLAN interfaces and a firewall policy allows it. VLANs alone do not block routing; they just limit broadcast domains.
Beginners hear 'isolated' and assume it means total, unbreakable isolation, forgetting that routers and firewalls are designed to break that isolation to allow controlled access.
Mistake
To create a VLAN on a FortiGate, I must first buy a managed switch and configure VLANs on that switch.
Correct
You can create a VLAN interface directly on a FortiGate firewall without any managed switch. The VLAN interface is a logical construct on the firewall. You do need a managed switch to tag traffic arriving at the firewall's physical port, but the firewall itself can create the VLAN and route traffic.
Beginners assume VLANs are a 'switch-only' feature because they first encounter VLANs in the context of network switches, not firewalls.
Mistake
DHCP Relay and DHCP Server are the same thing, just different names.
Correct
A DHCP Server allocates and manages IP addresses. A DHCP Relay is a middleman. It forwards DHCP requests from a VLAN to a central DHCP server. The relay does not store or manage any IP addresses; it just passes the message along.
The word 'relay' sounds passive, but beginners often assume it means 'relay server' implying some server functionality, which leads to confusion about configuration.
Mistake
Spanning Tree Protocol (STP) is unnecessary if I have a modern network. It slows down the network by blocking links.
Correct
STP is still essential in any network with redundancy. Without STP, a single accidental loop (like plugging a cable into the wrong port) can cause a catastrophic broadcast storm that crashes the network. STP prevents this by blocking redundant links, not by throttling traffic.
Beginners see 'blocking' as negative and assume modern switches are smart enough to avoid loops, underestimating how easy it is to create a loop accidentally.
Mistake
A VLAN interface on a FortiGate needs an IP address in the same range as the physical port it is attached to.
Correct
A VLAN interface must have an IP address from the subnet it serves (e.g., 192.168.10.1 for VLAN 10). The physical parent port (e.g., port1) typically does not have an IP address, or it has a different management IP. The physical port just carries tagged traffic; it is the logical interface that acts as the gateway.
Beginners confuse the physical interface's role (carrier of tagged traffic) with the logical interface's role (gateway for a specific VLAN).
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
No, you do not strictly need a managed switch. You can create VLAN interfaces directly on the FortiGate. However, to actually connect multiple devices from different VLANs to the same FortiGate port, you will need a managed switch that can tag traffic with the correct VLAN ID.
A VLAN tag is a small four-byte field inserted into the Ethernet frame (the data packet). It contains a 12-bit VLAN ID (0-4095). The switch and firewall read this tag to determine which virtual network the packet belongs to.
No. Each VLAN must have its own unique IP subnet (e.g., VLAN 10 uses 192.168.10.0/24, VLAN 20 uses 192.168.20.0/24). If two VLANs used the same subnet, devices would be unable to distinguish each other and routing would break.
This usually happens because the physical parent port is set to 'off' or is not connected. The VLAN interface is a child of the physical port. If the physical port is down, all VLAN interfaces on that port will also show as down. Check the physical cable and port status first.
A VLAN interface is a Layer 3 interface used for routing between different subnets. A software switch is a Layer 2 construct that groups multiple physical ports into a single broadcast domain (like a regular switch). You use a VLAN interface for inter-VLAN routing, and a software switch for simple port bridging.
Yes, VLAN 1 is the default VLAN on most managed switches. All switch ports are in VLAN 1 by default. It is strongly recommended to change this for security reasons, as attackers often target the default VLAN.
You've finished VLAN Interfaces and Basic Switching. Continue through the NSE4 study guide to build a complete picture of the exam.
Done with this chapter?